Privacy Policy

1. Information we collect

Information you provide:

• Account details — your email address, display name, and password (stored only as a secure hash).
• Security settings — if you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
• Email preferences — your email address and whether you have chosen to opt out of non-transactional email.
• Content you submit — lab feedback, votes, and broken-lab reports.
• Lab submissions you upload for grading (your CML export / device configurations), and configs you paste into the free /try grading demo — used to grade your work against the answer key.
• Subscription and purchase information, if and when you subscribe or buy paid labs or bundles. Card payments are handled by our payment processor, Stripe — we do not receive or store your full card number.

Information collected automatically:

• Usage and download activity — which labs you view, complete, and download.
• Technical data — your IP address and browser/device information, recorded in our server logs.
• How you first found us — the channel (search, social, a referral link, a campaign tag, or direct), the referring site, and the page you landed on. This is captured on your first visit and attached to the activity we record, whether or not you ever create an account; if you do create one, it is also saved to that account so we can tell which channels bring members.
• Aggregate site analytics — page views, referrers, and the country, device type, and browser your visit comes from. The analytics script is served from our own domain rather than a vendor’s, sets no cookies, and does not follow you to other sites.
• Cookies — to keep you signed in, to complete two-factor sign-in, and to measure how visitors arrive and whether the free demo leads to a signup (described in Section 3 below).

2. How we use your information

• To provide and operate the Service, including your account and downloads.
• To authenticate you and secure your account (two-factor authentication, blocking abusive accounts, rate limiting).
• To watermark each download with a unique identifier and to investigate and act on misuse, such as unauthorized redistribution. This may involve associating a leaked file with the account, email, and IP address that downloaded it.
• To send transactional email (such as account, security, and purchase messages), and to send account, onboarding, reminder, and other notification emails to members. Transactional email always sends; you can opt out of the non-transactional messages at any time using the unsubscribe link in any such email or from your account settings.
• To process purchases and grant access to paid content.
• To maintain, improve, and protect the Service, and to comply with legal obligations.

3. Cookies

Every cookie we set is first-party — set by this site, sent only back to this site. There are two kinds.

Sign-in cookies. To keep you signed in, to carry a short-lived two-factor sign-in challenge, to remember a device you choose to trust, and to display your recovery codes once.

Measurement cookies. Two cookies are set on your first page view and last 90 days:

• gf_acq — how you first arrived: the channel (search, social, referral, direct, or a campaign tag in the link you clicked), the referring site, and the page you landed on. It records your first visit only and is never overwritten. We read it every time we record an activity on the site — including for visitors who never create an account — and copy the channel, campaign tag, and landing page onto that record. If you create an account, it is also read at sign-up and saved to your account, so we can tell which channels bring members who go on to subscribe.
• gf_anon — a random identifier for your browser. It contains no email address, IP address, or device fingerprint, and it cannot be read by JavaScript. Its only purpose is to connect an anonymous /try grading session to the account it later produced, so we can tell whether the free demo is worth keeping.

We do not use advertising or third-party tracking cookies, and none of these cookies follows you to other sites. Our web analytics is proxied through this site’s own domain rather than loaded from a vendor’s, and sets no cookies of its own. You can clear any of these cookies from your browser at any time; clearing the sign-in ones signs you out.

4. How we share information

We do not sell your personal information. We share it only as needed to run the Service:

• With service providers who act on our behalf — for example, an email delivery provider (for verification and notification emails) and our payment processor, Stripe (for subscriptions and purchases). They may process your information only to provide those services to us.
• To comply with the law, enforce our Terms, or protect the rights, safety, and property of Goldfish Networks, our users, or others.
• In connection with a merger, acquisition, or sale of assets, in which case we will continue to protect your information consistent with this Policy.

Lab content is generated using AI providers; this process does not use your personal information.

5. Data retention

We keep account information for as long as your account is active and as needed to provide the Service. Server logs are retained for a limited period for security and troubleshooting. Because watermarking and anti-piracy protection depend on it, we may retain download and watermark records — including the associated email address and IP address — for as long as necessary to protect our rights and investigate misuse, which may be after your account is closed.

Lab submissions. We keep a copy of the CML export you upload for grading for up to 90 days, so that we can re-grade it if we correct a grading error, and to investigate a scoring problem you report. After that it is deleted automatically, and it is deleted when you close your account. Before a submission is stored, we redact credentials from it — passwords, enable secrets, key strings and SNMP community strings are replaced with a placeholder, so the stored copy keeps the structure our grader needs and none of your secrets.

How you found us. The attribution saved to your account from the gf_acq cookie — source, medium, campaign, referring site, and landing page — is erased when you close your account, or removed with the account entirely if there is no purchase history we must keep for our books. We do keep the anonymous measurement records the gf_anon identifier feeds — which step of the site was reached, when, and from which channel. They hold no email address, name, or IP address, and after closure the account they point to holds no identifying details either.

6. Security

We protect your information with measures including encrypted connections (HTTPS), hashed passwords, encrypted two-factor secrets, two-factor authentication, and access controls limiting who can reach administrative data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your choices & rights

• You can view and update your account details, and manage your two-factor and notification settings, from your account.
• You can opt out of non-transactional email (account, onboarding, reminder, and other notifications) at any time via the unsubscribe link in any such email or from your account settings; transactional email always sends.
• You may request access to, correction of, or deletion of your personal information by contacting us; note that we may retain certain records as described in Section 5.
• Depending on where you live, you may have additional rights under laws such as the EU/UK GDPR or the California Consumer Privacy Act (CCPA) — including rights to access, delete, or port your data, and to not be discriminated against for exercising them. We do not sell personal information. To exercise any right, contact us at the address below.

8. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

9. Where your information is processed

Goldfish Networks is operated from the United States, and your information is processed and stored in the United States. If you access the Service from outside the U.S., you consent to that processing.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Your continued use of the Service after changes take effect means you accept the updated Policy.

11. Contact

Questions or requests about your privacy? Contact us at support@goldfishnetworks.com.